chore: update Go to v1.27 (#39068)

Only made some necessary changes:

1. remove `GOEXPERIMENT`, only use jsonv2
1. `make fmt`
* `SigningKey` and `Signature` were affected due to some bugs in the
toolchain, so rewrote them
1. remove or fix fragile magic numbers and strings
    * the outputs of image/gzip/zlib packages are different
1. update "nolint" comments for the changed lint behaviors
1. add `tls.MLKEM1024`

modules/avatar/hash.go

@@ -9,20 +9,12 @@ import (
 	"strconv"
 )
 
-// HashAvatar will generate a unique string, which ensures that when there's a
-// different unique ID while the data is the same, it will generate a different
-// output. It will generate the output according to:
-// HEX(HASH(uniqueID || - || data))
-// The hash being used is SHA256.
-// The sole purpose of the unique ID is to generate a distinct hash Such that
-// two unique IDs with the same data will have a different hash output.
-// The "-" byte is important to ensure that data cannot be modified such that
-// the first byte is a number, which could lead to a "collision" with the hash
-// of another unique ID.
+// HashAvatar generates a unique string for input ID and data.
+// Because avatar is per-user, one user deletes their avatar should not affect another user who uses the same avatar.
 func HashAvatar(uniqueID int64, data []byte) string {
 	h := sha256.New()
 	h.Write([]byte(strconv.FormatInt(uniqueID, 10)))
-	h.Write([]byte{'-'})
+	h.Write([]byte{'-'}) // make sure the bytes in data won't conflict with ID
 	h.Write(data)
 	return hex.EncodeToString(h.Sum(nil))
 }

modules/avatar/hash_test.go

@@ -4,9 +4,6 @@
 package avatar_test
 
 import (
-	"bytes"
-	"image"
-	"image/png"
 	"testing"
 
 	"gitea.dev/modules/avatar"
@@ -15,12 +12,9 @@ import (
 )
 
 func Test_HashAvatar(t *testing.T) {
-	myImage := image.NewRGBA(image.Rect(0, 0, 32, 32))
-	var buff bytes.Buffer
-	png.Encode(&buff, myImage)
-
-	assert.Equal(t, "9ddb5bac41d57e72aa876321d0c09d71090c05f94bc625303801be2f3240d2cb", avatar.HashAvatar(1, buff.Bytes()))
-	assert.Equal(t, "9a5d44e5d637b9582a976676e8f3de1dccd877c2fe3e66ca3fab1629f2f47609", avatar.HashAvatar(8, buff.Bytes()))
-	assert.Equal(t, "ed7399158672088770de6f5211ce15528ebd675e92fc4fc060c025f4b2794ccb", avatar.HashAvatar(1024, buff.Bytes()))
+	buf := []byte{1, 2}
+	assert.Equal(t, "057b0e5aa7ef2504b886951f1355b3386130992bc867cb00c16babcc441571da", avatar.HashAvatar(1, buf))
+	assert.Equal(t, "18a4a808c40d70ed532b6f19dfe7b8732eeb727e375c87a9944fde7555de285c", avatar.HashAvatar(8, buf))
+	assert.Equal(t, "5265546b79c483b2c399bba1df5746f77bba7145bb9f53b7b9c6b0fb57dc25eb", avatar.HashAvatar(1024, buf))
 	assert.Equal(t, "161178642c7d59eb25a61dddced5e6b66eae1c70880d5f148b1b497b767e72d9", avatar.HashAvatar(1024, []byte{}))
 }